CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — Лабораторная работа по path traversal в NLTK Небольшая воспроизводимая Docker-лаборатория, которая сравнивает поведение percent-encoded path traversal в NLTK 3.9.4 с исправленным поведением в NLTK 3.10.0. Уязвимая версия проверяет имя ресурса до декодирования URL. Исправленный...

CVE-2026-0848

CVE-2026-0848 — NLTK StanfordSegmenter : exécution de code arbitraire via chargement d'un JAR non fiable -red?style=for-the-badge -brightgreen?style=for-the-badge Aperçu Champ| Détails ---|--- ID CVE| CVE-2026-0848 Paquet| nltk Natural Language Toolkit Registre| PyPI Versions affectées| = 3.9.2...

CVE-2026-0848-Scanner---Herramienta-de-Detecci-n

🔍 CVE-2026-0848 Scanner Инструмент обнаружения уязвимости CVE-2026-0848 в NLTK выполнение произвольного кода в StanfordSegmenter. ⚡ Установка git clone https://github.com/tu-usuario/CVE-2026-0848-Scanner.git cd CVE-2026-0848-Scanner pip install -r requirements.txt...

CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ ПРЕДУПРЕЖДЕНИЕ Этот код выполняет произвольные команды в вашей системе. Использовать ТОЛЬКО на виртуальных машинах или в изолированных контейнерах. Описание Функциональный PoC для CVE-2026-0848. Демонстрирует, как вредоносный JAR-файл может...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.2.0 Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof...

CVE-2026-79657

A flaw was found in NLTK. This vulnerability allows a remote attacker to achieve arbitrary code execution by supplying a specially crafted model or tokenizer artifact for the application to process. The issue occurs because the deserialization allowlist mechanism permits entire software namespace...

CVE-2019-14751_PoC

CVE-2019-14751PoC Une preuve de concept pour CVE-2019-14751 Description de la vulnérabilité Le téléchargeur NLTK antérieur à la version 3.5 est vulnérable à une traversée de répertoire, permettant aux attaquants d'écrire des fichiers arbitraires via un ../ dot dot slash dans un paquet NLTK archiv...

CVE-2026-78683

A flaw was found in NLTK. This vulnerability allows arbitrary code execution due to unsafe deserialization, where data loaded from storage is converted back into active objects without adequate restrictions. When the TransitionParser component processes a model file, it fails to enforce safe...

CVE-2026-0847

CVE-2026-0847 — NLTK Несколько классов CorpusReader: произвольное чтение файлов через обход пути -orange?style=for-the-badge Обзор Поле| Детали ---|--- CVE ID| CVE-2026-0847 Пакет| nltk Natural Language Toolkit Реестр| PyPI Затронутые версии| = 3.9.2 Тип уязвимости| CWE-22: Обход пути Path...

IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7287209: - NLTK versions 3.9.2 and prior are vulnerable to arbitrary...

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

PYSEC-2026-3868 NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

PYSEC-2026-3871 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

SummaryXMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appendingeach block to a growing fragment string, then calls VALIDXMLRE.matchfragmenton the full accumulated buffer every iteration. Because each iteration rescans theentire accumulated fragment, the total amount of work...

PYSEC-2026-3867 NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.\-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned i...

PYSEC-2026-3870 NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

Arbitrary Local File Read

NLTK is vulnerable to an Arbitrary Local File Read. The vulnerability is due to StreamBackedCorpusView directly calling builtins.open instead of the security-enforcing pathsec.open, which allows an attacker who controls the fileid argument to bypass the ENFORCE setting and read arbitrary local...

Server-Side Request Forgery (SSRF)

NLTK is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the destination when an HTTP proxy is configured, which allows an attacker to provide a validated public URL that the proxy redirects to an internal service, potentially exposing internal...